Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves

Transcription

1 CT-RSA 2012 February 29th, 2012 Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves Joint work with: Nicolas Estibals CARAMEL project-team, LORIA, Université de Lorraine / CNRS / INRIA, France Nicolas.Estibals@loria.fr Diego F. Aranha Jean-Luc Beuchat Jérémie Detrey Institute of Computing, University of Campinas, Brazil Graduate School of Systems and Information Engineering, University of Tsukuba, Japan CARAMEL project-team, LORIA, INRIA / Université de Lorraine / CNRS, France /* EPI CARAMEL */ C,A, /* Cryptologie, Arithmétique : */ R,a, /* Matériel et Logiciel */ M,E, L,i= 5,e, d[5],q[999 ]={0};main(N ){for (;i--;e=scanf("%" "d",d+i));for(a =*d; ++i<a ;++Q[ i*i% A],R= i[q]? R:i); for(;i --;) for(m =A;M --;N +=!M*Q [E%A ],e+= Q[(A +E*E- R*L* L%A) %A]) for( E=i,L=M,a=4;a;C= i*e+r*m*l,l=(m*e +i*l) %A,E=C%A+a --[d]);printf ("%d" "\n", (e+n* N)/2 /* cc caramel.c; echo f3 f2 f1 f0 p./a.out */ -A);}

2 Pairings and cryptology used as a primitive in many protocols and devices Boneh Lynn Shacham short signature Boneh Franklin identity-based encryption... N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 1 / 14

3 Pairings and cryptology used as a primitive in many protocols and devices Boneh Lynn Shacham short signature Boneh Franklin identity-based encryption... implementations needed for various targets online server high-speed software smart card low-resource hardware reach 128 bits of security (equivalent to AES) N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 1 / 14

4 What s a cryptographic pairing e : G 1 G 2 G T where (G 1, +), (G 2, +) and (G T, ) are cyclic groups of order l The discrete logarithm problem should be hard on these groups N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 2 / 14

5 What s a cryptographic pairing e : G 1 G 2 G T where (G 1, +), (G 2, +) and (G T, ) are cyclic groups of order l The discrete logarithm problem should be hard on these groups Bilinear map: e(ap, bq) = e(p, Q) ab N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 2 / 14

6 What s a cryptographic pairing e : G 1 G 2 G T where (G 1, +), (G 2, +) and (G T, ) are cyclic groups of order l The discrete logarithm problem should be hard on these groups Bilinear map: e(ap, bq) = e(p, Q) ab Symmetric pairing (Type-1): G 1 = G 2, exploited by some protocols N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 2 / 14

7 What s a cryptographic pairing e : G 1 G 2 G T where (G 1, +), (G 2, +) and (G T, ) are cyclic groups of order l The discrete logarithm problem should be hard on these groups Bilinear map: e(ap, bq) = e(p, Q) ab Symmetric pairing (Type-1): G 1 = G 2, exploited by some protocols Choice of the groups: G 1, G 2 : related to an algebraic curve G T : related to the field of definition of the curve N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 2 / 14

8 Classical choice of curves Barreto Naehrig curves + Lots of literature + Huge optimization efforts + Suited for 128 bits of security Arithmetic modulo p 256 bits No symmetric pairing N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 3 / 14

9 Classical choice of curves Barreto Naehrig curves + Lots of literature + Huge optimization efforts + Suited for 128 bits of security Arithmetic modulo p 256 bits No symmetric pairing Supersingular elliptic curves + Symmetric pairing Thanks to a distortion map ψ : G 1 G 2 + Small characteristic arithmetic No carry propagation Not suited to 128-bit security level Larger base field: F , F N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 3 / 14

10 Classical choice of curves Barreto Naehrig curves + Lots of literature + Huge optimization efforts + Suited for 128 bits of security Arithmetic modulo p 256 bits No symmetric pairing Supersingular elliptic curves + Symmetric pairing Thanks to a distortion map ψ : G 1 G 2 + Small characteristic arithmetic No carry propagation Not suited to 128-bit security level Larger base field: F , F N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 3 / 14

11 Classical choice of curves Barreto Naehrig curves + Lots of literature + Huge optimization efforts + Suited for 128 bits of security Arithmetic modulo p 256 bits No symmetric pairing Supersingular elliptic curves + Symmetric pairing Thanks to a distortion map ψ : G 1 G 2 + Small characteristic arithmetic No carry propagation Not suited to 128-bit security level Larger base field: F , F Solutions to the large base field needed by supersingular curves (Pairing 2010) Use fields of composite extension degree: benefit from faster field arithmetic but requires careful security analysis N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 3 / 14

12 Classical choice of curves Barreto Naehrig curves + Lots of literature + Huge optimization efforts + Suited for 128 bits of security Arithmetic modulo p 256 bits No symmetric pairing Supersingular elliptic curves + Symmetric pairing Thanks to a distortion map ψ : G 1 G 2 + Small characteristic arithmetic No carry propagation Not suited to 128-bit security level Larger base field: F , F Solutions to the large base field needed by supersingular curves (Pairing 2010) Use fields of composite extension degree: benefit from faster field arithmetic but requires careful security analysis (This work) Use genus-2 hyperelliptic curves: base field will be F N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 3 / 14

13 Elliptic curves E/K : y 2 + h(x) y = f (x) with deg h 1 and deg f = 3 O N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 4 / 14

14 Elliptic curves E(K) is a group E/K : y 2 + h(x) y = f (x) with deg h 1 and deg f = 3 O Q P N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 4 / 14

15 Elliptic curves E(K) is a group E/K : y 2 + h(x) y = f (x) with deg h 1 and deg f = 3 O L P,Q Q P N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 4 / 14

16 Elliptic curves E(K) is a group E/K : y 2 + h(x) y = f (x) with deg h 1 and deg f = 3 O Q R L P,Q P N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 4 / 14

17 Elliptic curves E(K) is a group E/K : y 2 + h(x) y = f (x) with deg h 1 and deg f = 3 O V R Q R L P,Q P N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 4 / 14

18 Elliptic curves E(K) is a group E/K : y 2 + h(x) y = f (x) with deg h 1 and deg f = 3 O V R Q R L P,Q P R = P + Q N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 4 / 14

19 Elliptic curves E(K) is a group E/K : y 2 + h(x) y = f (x) with deg h 1 and deg f = 3 In practice: K is a finite field F q E(F q ) is a finite group O V R Q R L P,Q P R = P + Q N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 4 / 14

20 Elliptic curves E(K) is a group E/K : y 2 + h(x) y = f (x) with deg h 1 and deg f = 3 In practice: K is a finite field F q O V R E(F q ) is a finite group l: a large prime dividing #E(F q ) Use the cyclic subgroup Q R L P,Q E(F q )[l] = {P [l]p = O} P R = P + Q N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 4 / 14

21 Genus-2 hyperelliptic curves C/K : y 2 + h(x) y = f (x) with deg h 2 and deg f = 5 O N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 5 / 14

22 Genus-2 hyperelliptic curves C(K) not a group! C/K : y 2 + h(x) y = f (x) with deg h 2 and deg f = 5 O N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 5 / 14

23 Genus-2 hyperelliptic curves C(K) not a group! C/K : y 2 + h(x) y = f (x) with deg h 2 and deg f = 5 But pairs of points {P 1, P 2 } O Q 2 P 2 P 1 Q 1 N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 5 / 14

24 Genus-2 hyperelliptic curves C(K) not a group! C/K : y 2 + h(x) y = f (x) with deg h 2 and deg f = 5 But pairs of points {P 1, P 2 } O Q 2 P 2 P 1 Q 1 N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 5 / 14

25 Genus-2 hyperelliptic curves C(K) not a group! C/K : y 2 + h(x) y = f (x) with deg h 2 and deg f = 5 But pairs of points {P 1, P 2 } O Q 2 P 2 R 1 P 1 R 2 Q 1 N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 5 / 14

26 Genus-2 hyperelliptic curves C(K) not a group! C/K : y 2 + h(x) y = f (x) with deg h 2 and deg f = 5 But pairs of points {P 1, P 2 } O Q 2 P 2 R 1 R 2 P 1 R 1 R 2 Q 1 {P 1, P 2 } + {Q 1, Q 2 } = {R 1, R 2 } N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 5 / 14

27 Genus-2 hyperelliptic curves C(K) not a group! But pairs of points {P 1, P 2 } C/K : y 2 + h(x) y = f (x) with deg h 2 and deg f = 5 O Q 2 More formally use the Jacobian Jac C (K) P 2 R 1 R 2 P 1 R 1 R 2 Q 1 {P 1, P 2 } + {Q 1, Q 2 } = {R 1, R 2 } N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 5 / 14

28 Genus-2 hyperelliptic curves C(K) not a group! C/K : y 2 + h(x) y = f (x) with deg h 2 and deg f = 5 But pairs of points {P 1, P 2 } O Q 2 More formally use the Jacobian Jac C (K) D P P 2 R 1 R 2 D R D Q P 1 R 1 R 2 Q 1 D P + D Q = D R N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 5 / 14

29 Genus-2 hyperelliptic curves C(K) not a group! C/K : y 2 + h(x) y = f (x) with deg h 2 and deg f = 5 But pairs of points {P 1, P 2 } O Q 2 More formally use the Jacobian Jac C (K) D P P 2 R 1 R 2 D R D Q general form of the elements (called divisor) P 1 R 1 R 2 Q 1 D P = (P 1 )+(P 2 ) 2(O) D P + D Q = D R N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 5 / 14

30 Genus-2 hyperelliptic curves C(K) not a group! C/K : y 2 + h(x) y = f (x) with deg h 2 and deg f = 5 But pairs of points {P 1, P 2 } O Q 2 More formally use the Jacobian Jac C (K) D P P 2 R 1 R 2 D R D Q general form of the elements (called divisor) P 1 R 1 R 2 Q 1 D P = (P 1 )+(P 2 ) 2(O) degenerate form (P) (O) D P + D Q = D R N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 5 / 14

31 Computing the pairing: Miller s algorithm (elliptic case) e : G 1 G 2 G T Reduced Tate pairing O N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 6 / 14

32 Computing the pairing: Miller s algorithm (elliptic case) P, Reduced Tate pairing e : E(F q )[l] G 2 G T O N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 6 / 14

33 Computing the pairing: Miller s algorithm (elliptic case) Reduced Tate pairing e : E(F q )[l] E(F q k)[l] G T P, Q k: embedding degree (curve parameter) O N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 6 / 14

34 Computing the pairing: Miller s algorithm (elliptic case) Reduced Tate pairing e : E(F q )[l] E(F q k)[l] µ l F q k P, Q f l,p (Q) qk 1 l k: embedding degree (curve parameter) O N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 6 / 14

35 Computing the pairing: Miller s algorithm (elliptic case) Reduced Tate pairing e : E(F q )[l] E(F q k)[l] µ l F q k P, Q f l,p (Q) qk 1 l k: embedding degree (curve parameter) O Miller functions: f n,p N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 6 / 14

36 Computing the pairing: Miller s algorithm (elliptic case) e : E(F q )[l] E(F q k)[l] µ l F q k Reduced Tate pairing P, Q f l,p (Q) qk 1 l k: embedding degree (curve parameter) O Miller functions: f n,p an inductive identity f 1,P = 1 f n+n,p = f n,p f n,p g [n]p,[n ]P N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 6 / 14

37 Computing the pairing: Miller s algorithm (elliptic case) e : E(F q )[l] E(F q k)[l] µ l F q k Reduced Tate pairing P, Q f l,p (Q) qk 1 l k: embedding degree (curve parameter) Miller functions: f n,p an inductive identity f 1,P = 1 f n+n,p = f n,p f n,p g [n]p,[n ]P g [n]p,[n ]P derived from the addition of [n]p and [n ]P g [n]p,[n ]P = L [n]p,[n ]P V [n+n ]P [n]p O [n ]P V [n+n ]P L [n]p,[n ]P [n + n ]P N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 6 / 14

38 Computing the pairing: Miller s algorithm (elliptic case) e : E(F q )[l] E(F q k)[l] µ l F q k Reduced Tate pairing P, Q f l,p (Q) qk 1 l k: embedding degree (curve parameter) Miller functions: f n,p an inductive identity f 1,P = 1 f n+n,p = f n,p f n,p g [n]p,[n ]P g [n]p,[n ]P derived from the addition of [n]p and [n ]P compute f l,p thanks to an addition chain in practice: double-and-add log 2 l iterations g [n]p,[n ]P = L [n]p,[n ]P V [n+n ]P [n]p O [n ]P V [n+n ]P L [n]p,[n ]P [n + n ]P N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 6 / 14

39 Miller s algorithm (hyperelliptic case) e : G 1 G 2 G T O N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 7 / 14

40 Miller s algorithm (hyperelliptic case) e : Jac C (F q )[l] Jac C (F q k)[l] µ l F q k O N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 7 / 14

41 Miller s algorithm (hyperelliptic case) e : Jac C (F q )[l] Jac C (F q k)[l] µ l F q k D 1, D 2 f l,d1 (D 2 ) qk 1 l Hyperelliptic Miller functions: f n,d same inductive identity f 1,D = 1 f n+n,d = f n,d f n,d g [n]d,[n ]D O N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 7 / 14

42 Miller s algorithm (hyperelliptic case) e : Jac C (F q )[l] Jac C (F q k)[l] µ l F q k D 1, D 2 f l,d1 (D 2 ) qk 1 l Hyperelliptic Miller functions: f n,d same inductive identity f 1,D = 1 f n+n,d = f n,d f n,d g [n]d,[n ]D g [n]d,[n ]D = L [n]d,[n ]D V [n+n ]D O g [n]d,[n ]D derived from the addition of [n]d and [n ]D use Cantor s addition algorithm [n]d [n + n ]D [n ]D L [n]d,[n ]D V [n+n ]D N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 7 / 14

43 Miller s algorithm (hyperelliptic case) e : Jac C (F q )[l] Jac C (F q k)[l] µ l F q k D 1, D 2 f l,d1 (D 2 ) qk 1 l Hyperelliptic Miller functions: f n,d same inductive identity f 1,D = 1 f n+n,d = f n,d f n,d g [n]d,[n ]D g [n]d,[n ]D = L [n]d,[n ]D V [n+n ]D O g [n]d,[n ]D derived from the addition of [n]d and [n ]D use Cantor s addition algorithm double-and-add algorithm log 2 l iterations [n]d L [n]d,[n ]D [n + n ]D V [n+n ]D [n ]D iterations are more complex N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 7 / 14

44 Genus-2 binary supersingular curve: our choice C d /F 2 m : y 2 + y = x 5 + x 3 + d with d F 2 A distortion map exists: symmetric pairing # Jac Cd (F 2 m) = 2 2m ± 2 (3m+1)/2 + 2 m ± 2 (m+1)/2 + 1 Embedding degree of the curve: k = 12 For 128 bits of security: F 2 m = F and d = 0 N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 8 / 14

45 Genus-2 binary supersingular curve: our choice C d /F 2 m : y 2 + y = x 5 + x 3 + d with d F 2 A distortion map exists: symmetric pairing # Jac Cd (F 2 m) = 2 2m ± 2 (3m+1)/2 + 2 m ± 2 (m+1)/2 + 1 Embedding degree of the curve: k = 12 For 128 bits of security: F 2 m = F and d = 0 Key property of the curve: [2] ((P) (O)) = (P) + (P) 2(O) N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 8 / 14

46 Genus-2 binary supersingular curve: our choice C d /F 2 m : y 2 + y = x 5 + x 3 + d with d F 2 A distortion map exists: symmetric pairing # Jac Cd (F 2 m) = 2 2m ± 2 (3m+1)/2 + 2 m ± 2 (m+1)/2 + 1 Embedding degree of the curve: k = 12 For 128 bits of security: F 2 m = F and d = 0 Key property of the curve: [2] ((P) (O)) = (P) + (P) 2(O) [4] ((P) (O)) = (P 4 ) + (P 4 ) 2(O) N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 8 / 14

47 Genus-2 binary supersingular curve: our choice C d /F 2 m : y 2 + y = x 5 + x 3 + d with d F 2 A distortion map exists: symmetric pairing # Jac Cd (F 2 m) = 2 2m ± 2 (3m+1)/2 + 2 m ± 2 (m+1)/2 + 1 Embedding degree of the curve: k = 12 For 128 bits of security: F 2 m = F and d = 0 Key property of the curve: [2] ((P) (O)) = (P) + (P) 2(O) [4] ((P) (O)) = (P 4 ) + (P 4 ) 2(O) [8] ((P) (O)) = (P 8 ) (O) N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 8 / 14

48 Genus-2 binary supersingular curve: our choice C d /F 2 m : y 2 + y = x 5 + x 3 + d with d F 2 A distortion map exists: symmetric pairing # Jac Cd (F 2 m) = 2 2m ± 2 (3m+1)/2 + 2 m ± 2 (m+1)/2 + 1 Embedding degree of the curve: k = 12 For 128 bits of security: F 2 m = F and d = 0 Key property of the curve: [2] ((P) (O)) = (P) + (P) 2(O) [4] ((P) (O)) = (P 4 ) + (P 4 ) 2(O) [8] ((P) (O)) = ([8]P) (O) octupling acts on the curve N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 8 / 14

49 Genus-2 binary supersingular curve: our choice C d /F 2 m : y 2 + y = x 5 + x 3 + d with d F 2 A distortion map exists: symmetric pairing # Jac Cd (F 2 m) = 2 2m ± 2 (3m+1)/2 + 2 m ± 2 (m+1)/2 + 1 Embedding degree of the curve: k = 12 For 128 bits of security: F 2 m = F and d = 0 Key property of the curve: [2] ((P) (O)) = (P) + (P) 2(O) [4] ((P) (O)) = (P 4 ) + (P 4 ) 2(O) [8] ((P) (O)) = ([8]P) (O) octupling acts on the curve f 8,D has a much simpler expression than f 2,D N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 8 / 14

50 Constructing the Optimal Eta pairing Algorithm Tate double & add #iterations 2m Vanilla Tate pairing: log 2 l log 2 # Jac C (F 2 m) 2m doublings N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 9 / 14

51 Constructing the Optimal Eta pairing Algorithm #iterations Tate double & add 2m Tate octuple & add 2m 3 Vanilla Tate pairing: log 2 l log 2 # Jac C (F 2 m) 2m doublings Use of octupling: simpler iteration also! N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 9 / 14

52 Constructing the Optimal Eta pairing Algorithm #iterations Tate Tate Barreto et al. double & add octuple & add η T pairing 2m 2m 3 m 2 Vanilla Tate pairing: log 2 l log 2 # Jac C (F 2 m) 2m doublings Use of octupling: simpler iteration also! η T pairing: Miller function is f ±2 (3m+1)/2 1,D 1 N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 9 / 14

53 Constructing the Optimal Eta pairing Algorithm Tate Tate Barreto et al. double & add octuple & add η T pairing Optimal Ate pairing #iterations 2m 2m 3 m 2 m 6 Vanilla Tate pairing: log 2 l log 2 # Jac C (F 2 m) 2m doublings Use of octupling: simpler iteration also! η T pairing: Miller function is f ±2 (3m+1)/2 1,D 1 Optimal Ate pairing distortion map ψ is much more complex iterations would be roughly twice as expensive optimal Ate pairing not considered here N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 9 / 14

54 Constructing the Optimal Eta pairing Algorithm #iterations Tate Tate Barreto et al. This paper double & add octuple & add η T pairing Optimal Eta pairing 2m 2m 3 m 2 m 6 Vanilla Tate pairing: log 2 l log 2 # Jac C (F 2 m) 2m doublings Use of octupling: simpler iteration also! η T pairing: Miller function is f ±2 (3m+1)/2 1,D 1 Optimal Ate pairing distortion map ψ is much more complex iterations would be roughly twice as expensive optimal Ate pairing not considered here Optimal Eta pairing N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 9 / 14

55 Constructing the Optimal Eta pairing Algorithm #iterations Tate Tate Barreto et al. This paper double & add octuple & add η T pairing Optimal Eta pairing 2m 2m 3 m 2 m 6 Vanilla Tate pairing: log 2 l log 2 # Jac C (F 2 m) 2m doublings Use of octupling: simpler iteration also! η T pairing: Miller function is f ±2 (3m+1)/2 1,D 1 Optimal Ate pairing distortion map ψ is much more complex iterations would be roughly twice as expensive optimal Ate pairing not considered here Optimal Eta pairing cannot use 2 m -th power Verschiebung: does not act on the curve N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 9 / 14

56 Constructing the Optimal Eta pairing Algorithm #iterations Tate Tate Barreto et al. This paper double & add octuple & add η T pairing Optimal Eta pairing 2m 2m 3 m 2 m 3 Vanilla Tate pairing: log 2 l log 2 # Jac C (F 2 m) 2m doublings Use of octupling: simpler iteration also! η T pairing: Miller function is f ±2 (3m+1)/2 1,D 1 Optimal Ate pairing distortion map ψ is much more complex iterations would be roughly twice as expensive optimal Ate pairing not considered here Optimal Eta pairing cannot use 2 m -th power Verschiebung: does not act on the curve but can use 2 3m -th power Verschiebung 33% improvement compared to Barreto et al. s work N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 9 / 14

57 Considering degenerate divisors Some protocols allow to choose the form of one or two input divisors Consider degenerate divisors of the form (P) (O) only 2 coordinates in F 2 m to represent such a divisor (instead of 4 coordinates for a general one) since octupling acts on the curve: we can work with a point! [8]((P) (O)) = ([8]P) (O) N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 10 / 14

58 Considering degenerate divisors Some protocols allow to choose the form of one or two input divisors Consider degenerate divisors of the form (P) (O) only 2 coordinates in F 2 m to represent such a divisor (instead of 4 coordinates for a general one) since octupling acts on the curve: we can work with a point! [8]((P) (O)) = ([8]P) (O) We may compute the pairing of two general divisors (GG) one degenerate and one general divisor (DG) halves the amount of computation lot of protocols allow this two degenerate divisors (DD) halves again the amount of computation some protocols still compatible N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 10 / 14

59 Implementations for Intel Core 2 Software implementation Computation time ( 10 6 cycles) Barreto Naehrig Supersingular elliptic E(F ) E(F 3 359) Genus-2 supersingular DD DG GG N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 11 / 14

60 Software implementation Implementations for Intel Core 2 and Nehalem architecture Use of the native binary field multiplier on Nehalem Computation time ( 10 6 cycles) Barreto Naehrig Supersingular elliptic E(F ) E(F 3 359) Genus-2 supersingular DD DG GG N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 11 / 14

61 Hardware implementation Optimal Eta pairing on general divisors Implemented on a finite field coprocessor F addition multiplication Frobenius endomorphism Post place-and-route estimations on a Virtex 6-LX 130T results Implementation Curve Area Time Area time (device usage) (ms) Cheung et al. E(F p254 ) 35 % Ghosh et al. E(F ) 76 % Estibals E(F ) 8 % This work C 0 (F 2 367) (GG) 7 % N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 12 / 14

62 Conclusion A novel pairing algorithm shortening Miller s loop Competitive timings compared to genus-1 pairings Comparable timings against non-symmetric pairings N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 13 / 14

63 Conclusion A novel pairing algorithm shortening Miller s loop Competitive timings compared to genus-1 pairings Comparable timings against non-symmetric pairings Most efficient symmetric pairing implementation for both software and hardware when at least one divisor is degenerate (DG and DD case) First hardware implementation of a genus-2 pairing reaching 128 bits of security N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 13 / 14

64 Conclusion A novel pairing algorithm shortening Miller s loop Competitive timings compared to genus-1 pairings Comparable timings against non-symmetric pairings Most efficient symmetric pairing implementation for both software and hardware when at least one divisor is degenerate (DG and DD case) First hardware implementation of a genus-2 pairing reaching 128 bits of security Perspectives Implement optimal Ate pairing on this curve (work in progress) Use theta functions for faster curve arithmetic N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 13 / 14

65 Thank you for your attention! Questions? N. Estibals Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves 14 / 14